@pikku/inspector 0.12.50 → 0.12.54

package/OPTIMIZATION-PLAN.md

@@ -59,9 +59,15 @@ node --import tsx src/benchmark.ts <target-dir> <iterations>
 | `wireMCPTool`          | `addMCPTool`          |
 | `wireMCPPrompt`        | `addMCPPrompt`        |
 | `wireWorkflowGraph`    | `addWorkflowGraph`    |
-| `wireSecret`           | `addSecret`           |
-| `wireOAuth2Credential` | `addOAuth2Credential` |
-| `wireVariable`         | `addVariable`         |
+| `defineSecret`         | `addSecret`           |
+| `defineCredential`     | `addCredential`       |
+| `defineScope`          | `addScope`            |
+| `defineVariable`       | `addVariable`         |
+
+`addAuth` stays outside the map: it matches several identifiers
+(`betterAuthStatelessSession`, `betterAuthSession`) and gates them on
+surrounding context rather than on the identifier alone, so it keeps running on
+every CallExpression.
 
 Fallback for unmatched identifiers: check `/pikku.*func/i` regex -> `addFunctions`.
 

package/dist/add/add-auth.d.ts

@@ -19,7 +19,7 @@ export declare const AUTH_HANDLER_FUNC_ID = "authHandler";
  *
  * The pikku CLI discovers that single export and generates a catch-all
  * `auth.gen.ts` that wires `${basePath}/**` to one shared handler, registers the
- * better-auth session middleware, and emits a `wireSecret` for every configured
+ * better-auth session middleware, and emits a `defineSecret` for every configured
  * social provider — so the auth routes and secret requirements flow through
  * normal inspection into the deploy manifest.
  *

package/dist/add/add-auth.js

@@ -112,7 +112,7 @@ const isInsideGlobalMiddlewareRegistration = (node) => {
  *
  * The pikku CLI discovers that single export and generates a catch-all
  * `auth.gen.ts` that wires `${basePath}/**` to one shared handler, registers the
- * better-auth session middleware, and emits a `wireSecret` for every configured
+ * better-auth session middleware, and emits a `defineSecret` for every configured
  * social provider — so the auth routes and secret requirements flow through
  * normal inspection into the deploy manifest.
  *

package/dist/add/add-cli.js

@@ -99,6 +99,13 @@ function processCLIConfig(logger, node, sourceFile, typeChecker, inspectorState,
             case 'tags':
                 // Already handled in first pass
                 break;
+            case 'auth': {
+                const value = getPropertyValue(node, 'auth');
+                if (typeof value === 'boolean') {
+                    programMeta.auth = value;
+                }
+                break;
+            }
             case 'commands':
                 if (ts.isObjectLiteralExpression(prop.initializer)) {
                     programMeta.commands = processCommands(logger, prop.initializer, sourceFile, typeChecker, programName, inspectorState, options, programTags);

package/dist/add/add-credential.js

@@ -9,7 +9,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
     const args = node.arguments;
     const firstArg = args[0];
     const expression = node.expression;
-    if (!ts.isIdentifier(expression) || expression.text !== 'wireCredential') {
+    if (!ts.isIdentifier(expression) || expression.text !== 'defineCredential') {
         return;
     }
     if (!firstArg) {

package/dist/add/add-functions.js

@@ -4,6 +4,24 @@ import { extractFunctionName, funcIdToTypeName, } from '../utils/extract-functio
 import { extractFunctionNode } from '../utils/extract-function-node.js';
 import { extractUsedWires } from '../utils/extract-services.js';
 import { formatVersionedId, parseVersionedId } from '@pikku/core';
+/** Binding keys a `pikkuScenarioStep` may declare, in report order. */
+const SCENARIO_SURFACE_KEYS = [
+    'browser',
+    'cli',
+    'default',
+];
+/**
+ * The step wrappers, and who acts in each.
+ *
+ * Which function was called *is* the kind. That is the whole reason these are
+ * three declarations rather than a `kind:` field on one: a string literal can be
+ * copied into an addon package by a consumer, a called identifier cannot.
+ */
+const SCENARIO_STEP_KINDS = new Map([
+    ['pikkuScenarioStep', 'persona'],
+    ['pikkuPlatformScenarioStep', 'platform'],
+    ['pikkuAddonScenarioStep', 'addon'],
+]);
 import { getPropertyValue, getArrayPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { canonicalJSON, hashString } from '../utils/hash.js';
 import { resolveMiddleware } from '../utils/middleware.js';
@@ -11,6 +29,7 @@ import { resolvePermissions } from '../utils/permissions.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { ErrorCode } from '../error-codes.js';
 import { findPiiPaths } from '../utils/check-pii-output.js';
+import { findRevealedSecretSinks } from '../utils/check-secret-sinks.js';
 import { isScenarioInstrumentationFunction } from './scenario-instrumentation.js';
 const isValidVariableName = (name) => {
     const regex = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
@@ -261,6 +280,66 @@ function computeImplementationHash(args) {
         config: objectNode ? printNode(objectNode) : null,
     }));
 }
+/**
+ * Registers a `pikkuRemoteChannelFunc` declaration: a name, its schemas and its
+ * description, with no body to inspect. The name has to reach `rpc.internalMeta`
+ * for `channel.remote` to resolve the schemas it validates each call against.
+ */
+const addRemoteChannelFunc = ({ state, logger, node, pikkuFuncId, name, exportedName, inputSchemaRef, outputSchemaRef, meta, }) => {
+    const sourceFile = node.getSourceFile().fileName;
+    if (!exportedName) {
+        logger.error(`• Remote channel function '${name}' is not exported, this is not allowed.`);
+        return;
+    }
+    // Two files declaring the same capability is the collision that matters:
+    // both ids are the bare name, so the id-compatibility check below reads them
+    // as the same function and lets the second overwrite the first.
+    const existingFunction = state.functions.meta[pikkuFuncId];
+    if (existingFunction &&
+        existingFunction.sourceFile &&
+        existingFunction.sourceFile !== sourceFile) {
+        logger.critical(ErrorCode.DUPLICATE_FUNCTION_NAME, `Function name '${name}' is not unique. ` +
+            `'${pikkuFuncId}' is already defined in '${existingFunction.sourceFile}' and cannot be redefined in '${sourceFile}'.`);
+        return;
+    }
+    const existing = state.rpc.internalMeta[name];
+    if (existing && !areCompatibleFunctionIds(existing, pikkuFuncId)) {
+        logger.critical(ErrorCode.DUPLICATE_FUNCTION_NAME, `Function name '${name}' is not unique. ` +
+            `It already points to '${existing}' in '${resolveExistingFunctionSource(state, existing) || 'unknown file'}', but '${pikkuFuncId}' in '${sourceFile}' tried to use the same name.`);
+        return;
+    }
+    const capitalizedName = funcIdToTypeName(name);
+    const registerSchema = (ref, suffix) => {
+        if (!ref)
+            return null;
+        const schemaName = `${capitalizedName}${suffix}`;
+        state.schemaLookup.set(schemaName, ref);
+        state.functions.typesMap.addCustomType(schemaName, 'unknown', []);
+        return schemaName;
+    };
+    const inputSchemaName = registerSchema(inputSchemaRef, 'Input');
+    const outputSchemaName = registerSchema(outputSchemaRef, 'Output');
+    state.functions.meta[pikkuFuncId] = {
+        pikkuFuncId,
+        functionType: 'remote',
+        funcWrapper: 'pikkuRemoteChannelFunc',
+        sessionless: true,
+        name,
+        services: { optimized: true, services: [] },
+        inputSchemaName,
+        outputSchemaName,
+        inputs: inputSchemaName ? [inputSchemaName] : [],
+        outputs: outputSchemaName ? [outputSchemaName] : [],
+        sourceFile,
+        exportedName,
+        ...meta,
+    };
+    state.functions.files.set(pikkuFuncId, { path: sourceFile, exportedName });
+    state.rpc.internalMeta[name] = pikkuFuncId;
+    // Imported so a local call gets the factory's "this runs on the client"
+    // error rather than a bare lookup miss.
+    state.rpc.internalFiles.set(pikkuFuncId, { path: sourceFile, exportedName });
+};
 /**
  * Inspect pikkuFunc calls, extract input/output and first-arg destructuring,
  * then push into state.functions.meta.
@@ -274,18 +353,19 @@ export const addFunctions = (logger, node, checker, state, options) => {
         return;
     }
     // Match identifiers that contain both "pikku" and "func" (case insensitive),
-    // plus pikkuScenario and pikkuScenarioStep (workflow wrappers without "func"
-    // in their names)
+    // plus pikkuScenario and the three scenario step wrappers (workflow wrappers
+    // without "func" in their names)
     const pikkuFuncPattern = /pikku.*func/i;
     if (!pikkuFuncPattern.test(expression.text) &&
         expression.text !== 'pikkuScenario' &&
-        expression.text !== 'pikkuScenarioStep') {
+        !SCENARIO_STEP_KINDS.has(expression.text)) {
         return;
     }
     // A scenario step is bundled like any invoked function, but is deliberately
     // never RPC-registered: a step may drive a browser, so exposing it over the
     // network would put a test harness on the public API surface.
-    const isScenarioStep = expression.text === 'pikkuScenarioStep';
+    const scenarioStepKind = SCENARIO_STEP_KINDS.get(expression.text);
+    const isScenarioStep = scenarioStepKind !== undefined;
     // A scenario's own body. Marked so the codegen partitions and the deploy
     // analyzer can tell it apart from an application workflow without having to
     // reach into the workflow graph.
@@ -316,6 +396,17 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let expose;
     let remote;
     let mcp;
+    /**
+     * A sessionless function's own `auth: true`. `sessionless` records the
+     * baseline — a `pikkuFunc` always needs a session — while this records the
+     * tightening a `pikkuSessionlessFunc` applies to itself, which is otherwise
+     * invisible to anything reading meta.
+     */
+    let auth;
+    /** The author's claim that the body authorizes its own callers. */
+    let permissionsInBody;
+    /** The function's `audit` config, resolved to its object form. */
+    let audit;
     let readonly_;
     let deploy;
     let approvalRequired;
@@ -323,7 +414,8 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let workflowQueued;
     let workflowRetries;
     let workflowTimeout;
-    let scenarioStepBrowser;
+    let scenarioStepSurfaces;
+    let scenarioStepAddon;
     let scenarioStepTemplate;
     let scopes;
     let version;
@@ -390,13 +482,74 @@ export const addFunctions = (logger, node, checker, state, options) => {
         expose = getPropertyValue(firstArg, 'expose');
         remote = getPropertyValue(firstArg, 'remote');
         mcp = getPropertyValue(firstArg, 'mcp');
+        auth = getPropertyValue(firstArg, 'auth');
+        permissionsInBody = getPropertyValue(firstArg, 'permissionsInBody');
+        if (permissionsInBody && !options.allow?.permissionsInBody) {
+            logger.critical(ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED, `'${name}' declares \`permissionsInBody: true\`, which this project has not enabled. ` +
+                `It silences the exposed-and-ungated audit without gating anything, so it is opt-in: ` +
+                `set \`allow: { permissionsInBody: true }\` in pikku.config.json if the project accepts ` +
+                `permission checks that only a reader can verify. Otherwise express the check as a ` +
+                `\`permissions\` entry, or drop \`expose: true\` if the function was not meant to be ` +
+                `callable from outside.`);
+            return;
+        }
+        // `audit` is either `true` or `{ durability }`, so it needs the nested read:
+        // getPropertyValue stringifies an object initializer rather than parsing it.
+        // Mirrors core's `resolveAuditConfig` — the two must agree, or meta would
+        // claim a durability the runner does not use.
+        const auditProp = firstArg.properties.find((p) => ts.isPropertyAssignment(p) &&
+            ts.isIdentifier(p.name) &&
+            p.name.text === 'audit');
+        if (auditProp && ts.isPropertyAssignment(auditProp)) {
+            const auditInit = auditProp.initializer;
+            if (auditInit.kind === ts.SyntaxKind.TrueKeyword) {
+                audit = { durability: 'best-effort' };
+            }
+            else if (ts.isObjectLiteralExpression(auditInit)) {
+                const durability = getPropertyValue(auditInit, 'durability');
+                audit = { durability: durability ?? 'best-effort' };
+            }
+        }
         readonly_ = getPropertyValue(firstArg, 'readonly');
         deploy = getPropertyValue(firstArg, 'deploy');
         approvalRequired = getPropertyValue(firstArg, 'approvalRequired');
         workflowQueued = getPropertyValue(firstArg, 'workflowQueued');
         workflowRetries = getPropertyValue(firstArg, 'workflowRetries');
         workflowTimeout = getPropertyValue(firstArg, 'workflowTimeout');
-        scenarioStepBrowser = getPropertyValue(firstArg, 'browser');
+        // A step declares one implementation per surface it supports; the binding
+        // keys that are present ARE the declaration, so there is nothing to read a
+        // value from — only names to collect.
+        const declaredSurfaces = SCENARIO_SURFACE_KEYS.filter((surface) => firstArg.properties.some((prop) => (ts.isPropertyAssignment(prop) ||
+            ts.isMethodDeclaration(prop) ||
+            ts.isShorthandPropertyAssignment(prop)) &&
+            ts.isIdentifier(prop.name) &&
+            prop.name.text === surface));
+        if (scenarioStepKind === 'platform' || scenarioStepKind === 'addon') {
+            // Neither kind has surfaces. Nobody clicks "Stripe's webhook arrives", and
+            // there is no human behind "the platform has expired the trial" — so both
+            // take a single `func`, and a binding key here is a coded error rather
+            // than a convention nobody reads.
+            if (declaredSurfaces.length > 0) {
+                logger.error(`• ${expression.text}('${name}') declares ${declaredSurfaces.join('/')} — a ${scenarioStepKind} step has one implementation, declared as \`func\`. Surfaces are how a person drives the system, and nobody drives this one.`);
+                return;
+            }
+            // The phase rule depends on it: an assertion runs every witness it has and
+            // fails if they disagree, so a step with exactly one witness by
+            // construction has to be unable to look like it has several.
+            scenarioStepSurfaces = ['default'];
+            if (scenarioStepKind === 'addon') {
+                scenarioStepAddon = getPropertyValue(firstArg, 'addon');
+                if (!scenarioStepAddon) {
+                    logger.error(`• pikkuAddonScenarioStep('${name}') needs a string literal \`addon\` naming the addon whose system acts — the same name its wireAddon declares.`);
+                    return;
+                }
+            }
+        }
+        else {
+            scenarioStepSurfaces = declaredSurfaces.length
+                ? declaredSurfaces
+                : undefined;
+        }
         scenarioStepTemplate = getPropertyValue(firstArg, 'template');
         scopes = getArrayPropertyValue(firstArg, 'scopes') ?? undefined;
         // Extract approvalDescription identifier reference
@@ -488,6 +641,23 @@ export const addFunctions = (logger, node, checker, state, options) => {
         }
         pikkuFuncId = formatVersionedId(baseName, version);
     }
+    // A remote channel capability is a contract with no body: the connected
+    // client answers it. Everything past this point reads the handler, so it gets
+    // its own path rather than a nullable handler threaded through all of it.
+    if (expression.text === 'pikkuRemoteChannelFunc') {
+        addRemoteChannelFunc({
+            state,
+            logger,
+            node,
+            pikkuFuncId,
+            name,
+            exportedName,
+            inputSchemaRef,
+            outputSchemaRef,
+            meta: { version, title, tags, summary, description, errors },
+        });
+        return;
+    }
     const isMCPToolFunc = expression.text === 'pikkuMCPToolFunc';
     const isListFunc = expression.text === 'pikkuListFunc';
     const mcpEnabled = mcp || isMCPToolFunc;
@@ -706,6 +876,18 @@ export const addFunctions = (logger, node, checker, state, options) => {
     // it runs ONLY when explicitly requested (`pikku all --security`) — see the
     // classificationCheck option. Default codegen skips it entirely.
     if (options.classificationCheck) {
+        // A revealed vault secret is invisible to the return-type scan below when it
+        // is written out mid-body rather than returned, so walk the sinks too.
+        for (const violation of findRevealedSecretSinks(checker, handler)) {
+            logger.diagnostic({
+                severity: 'error',
+                code: ErrorCode.SECRET_REVEALED_INTO_SINK,
+                message: `Function '${name}' passes a revealed secret to '${violation.sink}' ` +
+                    `at line ${violation.line} (path '${violation.path}').\n  ` +
+                    `A vault secret must not be written to a log, an audit, a queue, an email or a webhook. ` +
+                    `Pass the value only to the client that needs it, and reveal it there.`,
+            });
+        }
         const sig = checker.getSignatureFromDeclaration(handler);
         if (sig) {
             const rawRet = checker.getReturnTypeOfSignature(sig);
@@ -734,7 +916,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
                     message: `Sessionless function '${name}' exposes private-classified field(s) in its return type: ` +
                         privatePaths.map((p) => `'${p}'`).join(', ') +
                         `.\n  Private fields are only safe to return from authenticated (sessioned) functions. ` +
-                        `Either require a session (use pikkuFunc) or mark the column @public if it is safe to expose publicly.`,
+                        `Either require a session (use pikkuFunc) or set the column's security to 'public' in db/annotations.ts if it is safe to expose publicly.`,
                 });
             }
         }
@@ -795,6 +977,9 @@ export const addFunctions = (logger, node, checker, state, options) => {
         inputs: inputNames.filter((n) => n !== 'void') ?? null,
         outputs: outputNames.filter((n) => n !== 'void') ?? null,
         expose: expose || undefined,
+        auth: auth || undefined,
+        permissionsInBody: permissionsInBody || undefined,
+        audit,
         remote: remote || undefined,
         scenarioStep: isScenarioStep || undefined,
         scenario: isScenario || undefined,
@@ -806,7 +991,13 @@ export const addFunctions = (logger, node, checker, state, options) => {
         workflowQueued: workflowQueued === true ? true : undefined,
         workflowRetries: workflowRetries ?? undefined,
         workflowTimeout: workflowTimeout ?? undefined,
-        scenarioStepBrowser: scenarioStepBrowser === true ? true : undefined,
+        scenarioStepSurfaces,
+        // `persona` is the default reading of an unmarked step, so it is left off
+        // rather than written into every step meta a project already has.
+        scenarioStepKind: scenarioStepKind && scenarioStepKind !== 'persona'
+            ? scenarioStepKind
+            : undefined,
+        scenarioStepAddon,
         scenarioStepTemplate: scenarioStepTemplate || undefined,
         scopes: scopes ?? undefined,
         implementationHash,

package/dist/add/add-http-route.js

@@ -145,17 +145,23 @@ export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, bas
             inlineMeta.sessionless = targetMeta.sessionless;
         }
     }
+    // The route's own `auth`, falling back to the group's. Recorded on the meta
+    // below so an audit can answer "is this route open?" without re-reading the
+    // source: the route can tighten a sessionless function, and until this was
+    // written down that tightening existed only in the wiring.
+    const routeAuthProp = getPropertyValue(obj, 'auth');
+    const resolvedAuth = routeAuthProp === true || routeAuthProp === false
+        ? routeAuthProp
+        : inheritedAuth;
     // For inline functions (e.g. oauth2 handlers), propagate sessionless: true
     // when auth is explicitly disabled at the route or group level — the
     // developer opted out of auth so no session is required.
     {
         const inlineMeta = state.functions.meta[funcName];
-        if (inlineMeta && inlineMeta.sessionless === undefined) {
-            const routeAuth = getPropertyValue(obj, 'auth');
-            const resolvedAuth = routeAuth === true || routeAuth === false ? routeAuth : inheritedAuth;
-            if (resolvedAuth === false) {
-                inlineMeta.sessionless = true;
-            }
+        if (inlineMeta &&
+            inlineMeta.sessionless === undefined &&
+            resolvedAuth === false) {
+            inlineMeta.sessionless = true;
         }
     }
     // Lookup existing function metadata
@@ -239,6 +245,7 @@ export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, bas
         route: fullRoute,
         sourceFile: sourceFile.fileName,
         method: method,
+        ...(resolvedAuth !== undefined && { auth: resolvedAuth }),
         params: params.length > 0 ? params : undefined,
         query: query.length > 0 ? query : undefined,
         inputTypes: undefined,
@@ -284,6 +291,9 @@ export function registerHTTPRouteMeta({ route, state, logger, sourceFile, basePa
         route: fullRoute,
         sourceFile: sourceFile.fileName,
         method: method,
+        ...((route.auth ?? inheritedAuth) !== undefined && {
+            auth: route.auth ?? inheritedAuth,
+        }),
         params: params.length > 0 ? params : undefined,
         inputTypes: undefined,
         tags: tags.length > 0 ? tags : undefined,

package/dist/add/add-middleware.js

@@ -4,6 +4,49 @@ import { extractServicesFromFunction, extractUsedWires, } from '../utils/extract
 import { extractMiddlewareRefs } from '../utils/middleware.js';
 import { getPropertyValue } from '../utils/get-property-value.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
+/**
+ * Record a middleware group, keeping any registration already stored under the
+ * same pattern or tag.
+ *
+ * Several files may add middleware for one pattern — an app's own `'*'` group
+ * alongside the generated better-auth session bridge, say — and the runtime
+ * composes them. A plain `set` kept only the last, and codegen emits imports
+ * from what is stored, so the other file was never imported and its middleware
+ * silently stopped running. Merging is the only shape that cannot lose a gate;
+ * the first registration stays primary so single-registration groups serialize
+ * exactly as before.
+ */
+function recordMiddlewareGroup(groups, key, group) {
+    const existing = groups.get(key);
+    if (!existing) {
+        groups.set(key, group);
+        return;
+    }
+    // The same call seen twice — the inspector may revisit a file — is not a
+    // second registration, and appending it would emit a duplicate import.
+    const alreadyRecorded = [
+        existing,
+        ...(existing.additionalRegistrations ?? []),
+    ];
+    if (alreadyRecorded.some((r) => r.sourceFile === group.sourceFile && r.position === group.position)) {
+        return;
+    }
+    existing.additionalRegistrations = [
+        ...(existing.additionalRegistrations ?? []),
+        {
+            exportName: group.exportName,
+            sourceFile: group.sourceFile,
+            position: group.position,
+            isFactory: group.isFactory,
+        },
+    ];
+    existing.count += group.count;
+    existing.instanceIds = [...existing.instanceIds, ...group.instanceIds];
+    existing.services = {
+        optimized: false,
+        services: Array.from(new Set([...existing.services.services, ...group.services.services])),
+    };
+}
 function renameTempDefinitions(state, definitionIds, groupType, groupKey, storeKey = 'middleware') {
     const tempIndices = definitionIds
         .map((name, i) => (name.startsWith('__temp_') ? i : -1))
@@ -238,7 +281,7 @@ export const addMiddleware = (logger, node, checker, state) => {
             logger.warn(`• Middleware group '${exportedName}' for tag '${tag}' is not wrapped in a factory function. ` +
                 `For tree-shaking, use: export const ${exportedName} = () => addTagMiddleware('${tag}', [...])`);
         }
-        state.middleware.tagMiddleware.set(tag, {
+        recordMiddlewareGroup(state.middleware.tagMiddleware, tag, {
             exportName: exportedName,
             sourceFile,
             position: node.getStart(),
@@ -348,7 +391,7 @@ export const addMiddleware = (logger, node, checker, state) => {
             logger.warn(`• HTTP middleware group '${exportedName}' for pattern '${pattern}' is not wrapped in a factory function. ` +
                 `For tree-shaking, use: export const ${exportedName} = () => addHTTPMiddleware('${pattern}', [...])`);
         }
-        state.http.routeMiddleware.set(pattern, {
+        recordMiddlewareGroup(state.http.routeMiddleware, pattern, {
             exportName: exportedName,
             sourceFile,
             position: node.getStart(),
@@ -582,7 +625,7 @@ export const addMiddleware = (logger, node, checker, state) => {
             logger.warn(`• Channel middleware group '${exportedName}' for tag '${tag}' is not wrapped in a factory function. ` +
                 `For tree-shaking, use: export const ${exportedName} = () => addChannelMiddleware('${tag}', [...])`);
         }
-        state.channelMiddleware.tagMiddleware.set(tag, {
+        recordMiddlewareGroup(state.channelMiddleware.tagMiddleware, tag, {
             exportName: exportedName,
             sourceFile,
             position: node.getStart(),

package/dist/add/add-personas.d.ts

@@ -0,0 +1,13 @@
+import type { AddWiring } from '../types.js';
+/**
+ * Inspector for `definePersonas()` calls.
+ *
+ * A persona is entirely declaration — a person, their roles, what they want —
+ * so there is no code body and nothing to resolve at runtime. What is read here
+ * is the whole thing, and it is generated straight to `personas.gen.json` for
+ * the CLI and the console to read without loading the app.
+ *
+ * `name` is the one field that cannot be defaulted. A persona without one is
+ * not a person, and the console has nothing to show.
+ */
+export declare const addPersonas: AddWiring;